mirror of
https://github.com/sol1/rustguac.git
synced 2026-10-25 13:09:56 +00:00
Dave Kempe
2fa9877d85
Users are found by email, and with auto_create_users = false the email becomes the gate. An email alone is not proof of identity, since some providers let people set it, so a user is now bound to the OIDC subject of their first login and a login with the same email but a different subject is refused (and logged). A login the provider explicitly marks email_verified: false is refused too. New CLI-only command reset-oidc-subject releases the binding, for moving to a different identity provider or a recreated provider account; it is written to the CLI audit log. Emails match ignoring case, so an admin typing JSmith@Example.com no longer locks out a provider that sends jsmith@example.com, nor creates a second account with auto-create on; a user cannot be added twice in different case. add-user and POST /api/users check the email and name, and create_user reports "already exists" as a type instead of matching "UNIQUE" in the error text. Tests for the login rules, and CLI integration tests for add-user and reset-oidc-subject including their audit rows. Docs: how a login is matched, moving providers, POST /api/users, the CLI commands, and the login page message (a redirect, not a 403).